Splunk Search

Splunk DB Connect: Why am I unable to index data from a Postgres database?

kbarker302
Communicator

I am trying to index data from a Postgres database using DB Connect 1. I am able to make a connection to the database, and I can also run queries and see the data by clicking on the DB Query button under "Explore database schema" in the DB Connect 1 app. However, the data is not getting indexed when I create a database input.

I know that Splunk is able to retrieve the data, because it creates a kv_nnn.dbmonevt file under C:\Program Files\Splunk\var\spool\dbmon containing the data in key/value pairs, but this data never gets indexed. To rule out any issue with the data, I also tried specifying a query that returns just one column from my database table (the primary key) but this does not get indexed despite the kv_nnn.dbmonevt file being created.

Any help would be appreciated.

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

The problem was resolved by setting disabled=0 in inputs.conf for the database input.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

The problem was resolved by setting disabled=0 in inputs.conf for the database input.

s2_splunk
Splunk Employee
Splunk Employee

Can you share your inputs.conf file?

0 Karma

kbarker302
Communicator

Thank you - I believe you pointed me in the right direction. This is from my inputs.conf under etc\apps\dbx\local:

[batch://$SPLUNK_HOME\var\spool\dbmon*.dbmonevt]
crcSalt =
disabled = 1
move_policy = sinkhole
sourcetype = dbmon:spool

I'm not sure how or when the disabled flag got set, but I changed it to 0 and now I'm able to index the data.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yup, that would do it. Also note that since you didn't specify an index, your events will go to the default index (main). You may want to think about how to use multiple indexes, if you have different data retention or access permissions requirements for various data sources.

I will add the resolution as an answer, please accept it, so the question shows as 'answered'.

Happy Splunking!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...